Mulvenon: Stuxnet was Hiroshima

The use of Stuxnet was not merely an attempt to test the waters on cyber offense, it was a siginificant and destructive deployment of a cyber weapon, said James Mulvenon, chairman of the Cyber Conflict Studies Association and vice president of Defense Group, Inc. Mulvenon spoke July 10 at an event hosted by the Atlantic Council in Washington, D.C.

"For me, Stuxnet wasn't Trinity, it was Hiroshima. It was--we had seen declared tests. We knew about capabilities," said Mulvenon. "But in terms of that opening, destructive strike that really focused everyone's mind, for me, Stuxnet is Hiroshima."

And now that it has come to light that the United States was, in all likelihood, responsible for deploying Stuxnet and Flame, one panelist said the United States is even more vulnerable post-attack.

"If you are in a glass house, which I argue we are, you should not be the one initiating throwing rocks at each other because, you know, there--we will have, you know, rocks come back at us. And we probably have more glass to break with those sorts of rocks than most people," said Gregory Rattray, president of the CCSA and chief executive of Delta Risk, LLP.

While the U.S. is not currently at cyber war, the instability of the cyber landscape is moving in that direction, said Jason Healey, director of the cyber statecraft initiative at the Atlantic Council.

"If it becomes OK for non-states to reach out and smack states, or states to reach out and smack non-states, or states to smack states before there's an actual conflict, it's--I only see the instability getting worse," he said.

Right now states are dipping their toes in the water, testing cyber offensive capabilities, said Michael Mulville, cyber executive at Cisco Systems.

"You push a little bit, you see what happens and what you can get for something that potentially happens on a grander scale," said Mulville. "I'm not trying to be too gloomy, but you know, it's like anything else. You're kind of testing your system to see what's out there, and everybody's learning from it."

For more:
- go to the event page (audio and transcript available)

Related Articles:
Flame and Stuxnet were developed together early on, says Kaspersky Lab
ITU to issue Flame warning
DHS: no evidence that Flame targets industrial systems